c++ - 如何在另一个应用程序的另一个线程上调用 ldrLoadDll？

Question

我做了最简单的注入器 NtCreateThreadEx + LdrLoadDll，但是注入器将 dll 注入到自身而不是目标进程中（使用LoadLibraryW而不是LdrLoadDll ((wchar_t *) 0, 0, & name, & Module))，它可以正常工作 - 我怎样才能以最简单的方式解决问题

#include <windows.h>
#include <winternl.h>
#pragma comment(lib, "ntdll.lib")

using namespace std;

EXTERN_C NTSYSAPI NTSTATUS NTAPI NtCreateThreadEx(PHANDLE,
    ACCESS_MASK, LPVOID, HANDLE, LPTHREAD_START_ROUTINE, LPVOID,
    BOOL, SIZE_T, SIZE_T, SIZE_T, LPVOID);

typedef HMODULE(__stdcall* _LdrLoadDll)(
    wchar_t* PathToFile,
    unsigned long Flags,
    PUNICODE_STRING ModuleFileName,
    PHANDLE* ModuleHandle
    );
_LdrLoadDll LdrLoadDll;

int main()
{
    DWORD targetProcId = 10340; //Proc id to inject
    wchar_t targetDllPath[255] = L"C:\\DllTest32.dll"; //dll path to inject


    unsigned short targetDllPathLength = sizeof(targetDllPath);
    HANDLE targetOpened = OpenProcess(PROCESS_ALL_ACCESS, FALSE, targetProcId);
    LPVOID allocatedMem = VirtualAllocEx(targetOpened, 0, targetDllPathLength, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    bool wpm = WriteProcessMemory(targetOpened, allocatedMem, targetDllPath, targetDllPathLength, 0);

    LdrLoadDll = (_LdrLoadDll)GetProcAddress(GetModuleHandleA("ntdll.dll"), "LdrLoadDll");
    UNICODE_STRING name;
    name.Buffer = targetDllPath;
    name.Length = wcslen(name.Buffer) * sizeof(wchar_t);
    name.MaximumLength = name.Length + sizeof(wchar_t);
    PHANDLE Module;


    HANDLE rt;
    NtCreateThreadEx(
        &rt, PROCESS_CREATE_THREAD, NULL, targetOpened,
        (LPTHREAD_START_ROUTINE)LdrLoadDll((wchar_t*)0, 0, &name, &Module),
        allocatedMem, FALSE, NULL, NULL, NULL, NULL);
}

标签： c++winapi